BUUCTF [第二章 web进阶]XSS闯关

最新推荐文章于 2026-03-27 19:41:31 发布

原创

最新推荐文章于 2026-03-27 19:41:31 发布 · 2.1k 阅读

标签

#CTF

本文详细解读了六个阶段的XSS攻击，从URL篡改到利用编码技巧绕过过滤，涉及代码片段展示和解决方案。了解如何在实际场景中规避并理解此类安全威胁。

题目

第一关

这一关没有过滤直接修改url就行

?username=<script>alert('xss')</script>

第二关

这一题样式没什么变化直接上源码


<html lang="zh"><head>
    <meta charset="UTF-8">
    <title>XSS配套测试平台</title>
    <meta http-equiv="Content-Type" content="text/html; charset=utf-8">
    <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1">
    <meta http-equiv="X-UA-Compatible" content="IE=Edge">
    <link rel="stylesheet" href="/https://houtai.baidu.com/v2/csssdk">
    <script type="text/javascript" src="main.js"></script>
    <style>
        html, body, .app-wrapper {
            position: relative;
            width: 100%;
            height: 100%;
            margin: 0;
            padding: 0;
        }
    </style>
</head>
<body>
    <div id="root" class="app-wrapper amis-scope"><div class="amis-routes-wrapper"><div class="a-Toast-wrap a-Toast-wrap--topRight"></div><div class="a-Page"><div class="a-Page-content"><div class="a-Page-main"><div class="a-Page-header"><h2 class="a-Page-title"><span class="a-TplField">XSS test platform</span></h2></div><div class="a-Page-body"><span class="a-TplField">
    	<div id="ccc">
    		
    	</div>
    </span></div></div></div></div></div></div>
    <script type="text/javascript">
    	if(location.search == ""){
    		location.search = "?username=xss"
    	}
    	var username = 'xss';
    	document.getElementById('ccc').innerHTML= "Welcome " + escape(username);
    </script>

</body></html>

真正有用的地方，这里有个escape加密

<script type="text/javascript">
    	if(location.search == ""){
    		location.search = "?username=xss"
    	}
    	var username = 'xss';
    	document.getElementById('ccc').innerHTML= "Welcome " + escape(username);
    </script>

url修改，我们把前面的username闭合，这样就可以直接执行后门的弹窗命令了